teslacrypt | 73a2ed1606f22e828554948d7f79dd99f2858bc3465e5065abcbf90d98583b3c

Analysis

max time kernel
135s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe
Size

328KB
MD5

05a30994821845197be5d1ebb616dbbb
SHA1

0bf4c283b2ecac2d8d94074248403d89754c688f
SHA256

73a2ed1606f22e828554948d7f79dd99f2858bc3465e5065abcbf90d98583b3c
SHA512

6bcffb9ec948aee21851e299a8a96a6c795c5546fad7d2f737ceb5f6d782975551b0f77e8e6c91450d5ee881f8e8d35eceb1944101eb94656b42a1e72c1e6073
SSDEEP

6144:a9zyYnK/Poydbl3rFLRN8kAZyubtSiTsflsyAC9RM4ATGtMHoLm:8sgKdrBRMdSOCPbxL

Score

10^/10

teslacrypt persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+lebif.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/40FA5AFAA23B61ED 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/40FA5AFAA23B61ED 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/40FA5AFAA23B61ED If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/40FA5AFAA23B61ED 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/40FA5AFAA23B61ED http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/40FA5AFAA23B61ED http://yyre45dbvn2nhbefbmh.begumvelic.at/40FA5AFAA23B61ED Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/40FA5AFAA23B61ED

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/40FA5AFAA23B61ED

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/40FA5AFAA23B61ED

http://yyre45dbvn2nhbefbmh.begumvelic.at/40FA5AFAA23B61ED

http://xlowfznrg4wf7dli.ONION/40FA5AFAA23B61ED

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (893) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exejlsbaljyllwo.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	jlsbaljyllwo.exe

Drops startup file 6 IoCs

Processes:

jlsbaljyllwo.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe

Executes dropped EXE 1 IoCs

Processes:

jlsbaljyllwo.exe

pid process

3416 jlsbaljyllwo.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

jlsbaljyllwo.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owltbkd = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\jlsbaljyllwo.exe"	jlsbaljyllwo.exe

Drops file in Program Files directory 64 IoCs

Processes:

jlsbaljyllwo.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-125.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-32_contrast-white.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-30_altform-unplated.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_DogEar.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-100.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-150.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-unplated.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-100.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pl-PL\View3d\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-125.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-100.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Google\Chrome\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Windows Media Player\Icons\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-32.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-24.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\lua\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-32.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-150.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\BrushBump64.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Velocity\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-100.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-32_altform-unplated.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\View3d\_ReCoVeRy_+lebif.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-150.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteLargeTile.scale-200.png	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\_ReCoVeRy_+lebif.html	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\it-IT\_ReCoVeRy_+lebif.txt	jlsbaljyllwo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\SmallTile.scale-100.png	jlsbaljyllwo.exe

Drops file in Windows directory 2 IoCs

Processes:

05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\jlsbaljyllwo.exe	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe
File opened for modification	C:\Windows\jlsbaljyllwo.exe	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

jlsbaljyllwo.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings jlsbaljyllwo.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4256 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	jlsbaljyllwo.exe

pid	process
4256	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jlsbaljyllwo.exe

pid	process
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe
3416	jlsbaljyllwo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2560 msedge.exe
2560 msedge.exe
2560 msedge.exe
2560 msedge.exe
2560 msedge.exe
2560 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exejlsbaljyllwo.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe
Token: SeDebugPrivilege	3416	jlsbaljyllwo.exe
Token: SeIncreaseQuotaPrivilege	1572	WMIC.exe
Token: SeSecurityPrivilege	1572	WMIC.exe
Token: SeTakeOwnershipPrivilege	1572	WMIC.exe
Token: SeLoadDriverPrivilege	1572	WMIC.exe
Token: SeSystemProfilePrivilege	1572	WMIC.exe
Token: SeSystemtimePrivilege	1572	WMIC.exe
Token: SeProfSingleProcessPrivilege	1572	WMIC.exe
Token: SeIncBasePriorityPrivilege	1572	WMIC.exe
Token: SeCreatePagefilePrivilege	1572	WMIC.exe
Token: SeBackupPrivilege	1572	WMIC.exe
Token: SeRestorePrivilege	1572	WMIC.exe
Token: SeShutdownPrivilege	1572	WMIC.exe
Token: SeDebugPrivilege	1572	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1572	WMIC.exe
Token: SeRemoteShutdownPrivilege	1572	WMIC.exe
Token: SeUndockPrivilege	1572	WMIC.exe
Token: SeManageVolumePrivilege	1572	WMIC.exe
Token: 33	1572	WMIC.exe
Token: 34	1572	WMIC.exe
Token: 35	1572	WMIC.exe
Token: 36	1572	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1572	WMIC.exe
Token: SeSecurityPrivilege	1572	WMIC.exe
Token: SeTakeOwnershipPrivilege	1572	WMIC.exe
Token: SeLoadDriverPrivilege	1572	WMIC.exe
Token: SeSystemProfilePrivilege	1572	WMIC.exe
Token: SeSystemtimePrivilege	1572	WMIC.exe
Token: SeProfSingleProcessPrivilege	1572	WMIC.exe
Token: SeIncBasePriorityPrivilege	1572	WMIC.exe
Token: SeCreatePagefilePrivilege	1572	WMIC.exe
Token: SeBackupPrivilege	1572	WMIC.exe
Token: SeRestorePrivilege	1572	WMIC.exe
Token: SeShutdownPrivilege	1572	WMIC.exe
Token: SeDebugPrivilege	1572	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1572	WMIC.exe
Token: SeRemoteShutdownPrivilege	1572	WMIC.exe
Token: SeUndockPrivilege	1572	WMIC.exe
Token: SeManageVolumePrivilege	1572	WMIC.exe
Token: 33	1572	WMIC.exe
Token: 34	1572	WMIC.exe
Token: 35	1572	WMIC.exe
Token: 36	1572	WMIC.exe
Token: SeBackupPrivilege	3792	vssvc.exe
Token: SeRestorePrivilege	3792	vssvc.exe
Token: SeAuditPrivilege	3792	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3360	WMIC.exe
Token: SeSecurityPrivilege	3360	WMIC.exe
Token: SeTakeOwnershipPrivilege	3360	WMIC.exe
Token: SeLoadDriverPrivilege	3360	WMIC.exe
Token: SeSystemProfilePrivilege	3360	WMIC.exe
Token: SeSystemtimePrivilege	3360	WMIC.exe
Token: SeProfSingleProcessPrivilege	3360	WMIC.exe
Token: SeIncBasePriorityPrivilege	3360	WMIC.exe
Token: SeCreatePagefilePrivilege	3360	WMIC.exe
Token: SeBackupPrivilege	3360	WMIC.exe
Token: SeRestorePrivilege	3360	WMIC.exe
Token: SeShutdownPrivilege	3360	WMIC.exe
Token: SeDebugPrivilege	3360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3360	WMIC.exe
Token: SeRemoteShutdownPrivilege	3360	WMIC.exe
Token: SeUndockPrivilege	3360	WMIC.exe
Token: SeManageVolumePrivilege	3360	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exejlsbaljyllwo.exemsedge.exe

description	pid	process	target process
PID 244 wrote to memory of 3416	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe	jlsbaljyllwo.exe
PID 244 wrote to memory of 3416	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe	jlsbaljyllwo.exe
PID 244 wrote to memory of 3416	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe	jlsbaljyllwo.exe
PID 244 wrote to memory of 2236	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe	cmd.exe
PID 244 wrote to memory of 2236	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe	cmd.exe
PID 244 wrote to memory of 2236	244	05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe	cmd.exe
PID 3416 wrote to memory of 1572	3416	jlsbaljyllwo.exe	WMIC.exe
PID 3416 wrote to memory of 1572	3416	jlsbaljyllwo.exe	WMIC.exe
PID 3416 wrote to memory of 4256	3416	jlsbaljyllwo.exe	NOTEPAD.EXE
PID 3416 wrote to memory of 4256	3416	jlsbaljyllwo.exe	NOTEPAD.EXE
PID 3416 wrote to memory of 4256	3416	jlsbaljyllwo.exe	NOTEPAD.EXE
PID 3416 wrote to memory of 2560	3416	jlsbaljyllwo.exe	msedge.exe
PID 3416 wrote to memory of 2560	3416	jlsbaljyllwo.exe	msedge.exe
PID 2560 wrote to memory of 1464	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 1464	2560	msedge.exe	msedge.exe
PID 3416 wrote to memory of 3360	3416	jlsbaljyllwo.exe	WMIC.exe
PID 3416 wrote to memory of 3360	3416	jlsbaljyllwo.exe	WMIC.exe
PID 3416 wrote to memory of 2524	3416	jlsbaljyllwo.exe	cmd.exe
PID 3416 wrote to memory of 2524	3416	jlsbaljyllwo.exe	cmd.exe
PID 3416 wrote to memory of 2524	3416	jlsbaljyllwo.exe	cmd.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2428	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 712	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 712	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2844	2560	msedge.exe	msedge.exe
PID 2560 wrote to memory of 2844	2560	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

jlsbaljyllwo.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jlsbaljyllwo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	jlsbaljyllwo.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05a30994821845197be5d1ebb616dbbb_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244

C:\Windows\jlsbaljyllwo.exe
C:\Windows\jlsbaljyllwo.exe
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3416

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
3⤵
- Opens file in notepad (likely ransom note)
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72a446f8,0x7ffe72a44708,0x7ffe72a44718
4⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
4⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
4⤵
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
4⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
4⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
4⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
4⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
4⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
4⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
4⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
4⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15662361338289944563,9529391403328732578,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
4⤵
PID:4632

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\JLSBAL~1.EXE
3⤵
PID:2524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\05A309~1.EXE
2⤵
PID:2236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+lebif.html
Filesize
12KB

MD5
f99315bc0c3259e1b0264f0ace036dcd

SHA1
832da79a5fba7eb92e39d86bb345978f53203060

SHA256
796c9eb28dc5f3efdc36cfc96b939748f9d3335872d4bf1e33c8535f2984d5fe

SHA512
6d09f860e6c35d54c7738d5cb6b3e00652d88048eaf81b7186e5452f2ccd13d327349b1186d3436c1fbd40f86b04158916ab1c535218ecb521bd08c7fdb343cc

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+lebif.png
Filesize
65KB

MD5
db6bf9d37c1a2cd332f1feb29851d9b8

SHA1
5bf8f8032277a3e78bf2bb39e5f1b64c1bcb7457

SHA256
10b18bd1c7f87125e044d00e73749b506085635997d0a7627dd2ed598d9449d0

SHA512
c306551997319526dcdd72c2ee5200a525a8fc751645eb0f57239e1a9f152b3f8a40e703e61c03c47d575d6b40f49e4447339051344d7b0b5a82888ec35dc0c3

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+lebif.txt
Filesize
1KB

MD5
09d1e613381ebbe2e395604eb3bb2a23

SHA1
a78e7d578c9613b3d6ab92cedda1ced0325f9896

SHA256
ace05de6fa4b6d9ca632cb19033747776d9f28305995d2d0fea95713bcabb665

SHA512
e86f1e4e3ddaba954aed2505c889b16c31198dfb39378777e657a698ab97215de3eb97ec085f6cf9f7eebee781db2ccee4217f0bc0b7b62c672edb9ba3bdb83b

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
560B

MD5
809f283d585f87108787fabd6444e722

SHA1
a84fea6941f8086403d92856626294a81cdbf06e

SHA256
1427d6a6da7c744e92d56278c7be1bca8f1380491c52f98566cd3c5a1586ec40

SHA512
672613a577b8c8a50cb3c439f80feaa3b78530c30e0cc3087817976ecf5ae82c95b9029b82bb76f4e7d0ce3ced3e5599fad84dc700e4ed0586614ac92fd82e13

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Filesize
560B

MD5
6b2699361cef3231e918d48d428c8a09

SHA1
b9e863cee582f0b62dc04a3a316208c81eb94a46

SHA256
bc06834e19bff679e5d47b90e18c053dd7d38d9150a212f8fe90eb8ed0d7b87a

SHA512
d82c560443167e0a76d6e093c413c69103bc0b3024b088c542cc8bde4faeba7f2c876df6762503da222108d1207444f207b590f75edf6097eabde0e298034c71

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Filesize
416B

MD5
f43ca9a484c1897630f4125534cc344f

SHA1
26be1132ff3a91d2059e99dd24a1d54936658123

SHA256
f2da53c94153595d6ed74705cd85312f020b739708f72e5b1dee7b5b13d626d4

SHA512
d869f2907dfcbdb0a96ec3c701e3ef5d5c8029b4796a035570c01c62523c4fc0b3b2fa13c20f680c441eafba4e25cc5ea1c0c90c8d5e6d0a72acc57daf756020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7a0083feb33a40afb00513339dedeb22

SHA1
d4367b84eea7518ef62d863d86098ffc5bed5a64

SHA256
61fa3c27c2dd2039052be1a9b5c5ea22e9a48a6a90b317368469f50da1e23d0c

SHA512
39011bc2c45da8c0385a311e76b07cc1f5a5699c6f6a3fe2fdaeb297a50fcbd0a6fa74c894cd4db5cbd8390433a6a7b46eb87399c63c93d55868f264f26dac49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dc6700a7054fc638b1a5d30abafe58cc

SHA1
2c32dec8a1f89003dfaa00891eee8502e4b20bc5

SHA256
64cebeaa645a27938f85139bf718b5857241e617957760ae3be9dd986740e039

SHA512
5dc3403dbe1b3f380f350402b1aedcb3efdb147e8230c74f404f7942398df86810e54c3810f585c2cd04d463160fa78a5150c04661afeb4aed5cfd01daca343c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
f562f1a12042b320f5a2f666364bb1e2

SHA1
bc1221502c82ce40270cb67da2966b8e0901da52

SHA256
4bfa50999026debf110a8b3a4cee5f30d97093740a041b12a11444478a39dd94

SHA512
39522e5c2fd4417bd40637c32327b72344bff59d7192bb9ed6d4d56bab9b60fac804b8e933c21c1c28632d9af81dbee20caffe58e43b27444865045c9c5d7203

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838338840824.txt
Filesize
77KB

MD5
6373beb912e6d82d2c6c4cf265df2ca0

SHA1
435beab28b8fffa436de7e5c081cb35afdf7b2d8

SHA256
3a56d630433f36c86dcf7c139523de0f2ab5b5d0bbf313eea71225128869017c

SHA512
5a7dc7ef197ba54e9fd22d64f756f6452559a6d6d189f1581ac642ed294f0c5e28d89e30f39694bc6bcf3476e306c1be3eb488193c7a58bfc5bffb9e3c89922d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840260629574.txt
Filesize
47KB

MD5
89f8644a7a211e318878fefb56d4ed4a

SHA1
03a15617b76d2b2d90ce38791009b3476c41744d

SHA256
8a8dd879bb4bf7069f90f660edf787bd25af56fdacfe4d79dedb8d7c61780d3c

SHA512
c6d73db2efc4df0c5add6dab737ad8f6a2763aa75a3e57cba46bcbcdbd50d561369110522769bdce9af31880fa98615a028b6921419b188bdf821aa148a44032

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848943443912.txt
Filesize
75KB

MD5
3bdacdfd1fb384e84a1f9f268d27beee

SHA1
3a111bab8a320f5e429dcb1130252e6f9b205757

SHA256
979b7ac27137deb46c1756e54a264d8149eddd6da3cd41c38611152a00835fee

SHA512
0f974a122d27cd4621a4c8378afa8de62c4202f2955b37435e45db2a54d9cb2c685d34bd74dd89e00078123e70e80b700b67b47316d1cc830888c921797a8002

Download Submit
C:\Windows\jlsbaljyllwo.exe
Filesize
328KB

MD5
05a30994821845197be5d1ebb616dbbb

SHA1
0bf4c283b2ecac2d8d94074248403d89754c688f

SHA256
73a2ed1606f22e828554948d7f79dd99f2858bc3465e5065abcbf90d98583b3c

SHA512
6bcffb9ec948aee21851e299a8a96a6c795c5546fad7d2f737ceb5f6d782975551b0f77e8e6c91450d5ee881f8e8d35eceb1944101eb94656b42a1e72c1e6073

Download Submit
\??\pipe\LOCAL\crashpad_2560_HLYRAWLYOOKISNXR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/244-0-0x00000000022B0000-0x0000000002336000-memory.dmp

Filesize
536KB

Download
memory/244-13-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/244-14-0x00000000022B0000-0x0000000002336000-memory.dmp

Filesize
536KB

Download
memory/244-2-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3416-3641-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3416-10562-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3416-10553-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3416-10116-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3416-6738-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3416-12-0x0000000002170000-0x00000000021F6000-memory.dmp

Filesize
536KB

Download